CVE-2026-100109 in Security for WooCommerce Plugin
Summary
by MITRE • 11/05/2026
The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts and take over the site.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in Security For WooCommerce versions 1.0.10 through 1.0.16 represents a critical failure in access control mechanisms within a widely used WordPress e-commerce plugin. This flaw stems from an improper implementation of authorization checks during user registration processes that are exposed to unauthenticated users. Specifically, the plugin exposes an action endpoint accessible without any form of authentication or session validation. When this endpoint is invoked, it fails to verify whether the requesting entity possesses the necessary capabilities to create new accounts or assign specific roles within the WordPress environment. This absence of capability verification allows external actors to interact with the user creation logic directly through HTTP requests, bypassing standard security boundaries that typically restrict such administrative functions to authenticated users with elevated privileges.
The technical core of this vulnerability lies in the ability for an attacker to manipulate the role assignment parameter during the account creation process. In a secure implementation, new accounts created via public-facing registration forms are typically assigned low-privilege roles such as Subscriber or Customer by default, and any elevation requires explicit administrative approval. However, due to the missing capability checks, the plugin accepts user-supplied input for the role field without validating if that assignment is permissible for the context of a publicly accessible endpoint. This allows an unauthenticated attacker to specify administrator-level roles during registration. By doing so, the attacker can successfully register a new account with full administrative privileges on the WordPress site hosting the vulnerable plugin version.
The operational impact of this vulnerability is severe and potentially catastrophic for any website relying on this software stack. Once an attacker creates an administrator account, they gain complete control over the entire WordPress installation. This level of access enables the execution of arbitrary code, modification of core files, insertion of malicious plugins or themes, and exfiltration of sensitive customer data stored in the WooCommerce database. The compromise extends beyond mere defacement; it facilitates long-term persistence within the system, allowing for further lateral movement if other services are accessible from the compromised server environment. Given that WordPress powers a significant portion of the web, this vulnerability poses a substantial risk to e-commerce businesses and their customers, potentially leading to financial loss, data breaches, and reputational damage.
From a classification perspective, this issue aligns with CWE-269, which denotes Improper Privilege Assignment, as well as CWE-862, Missing Authorization, because the application fails to enforce proper access controls on critical functions. In terms of attack vectors, it corresponds to MITRE ATT&CK technique T1136.001, known as Create Account: Local Account, where adversaries create new accounts with administrative privileges to maintain persistent access and escalate their standing within the compromised environment. The vulnerability is exploitable remotely without prior authentication, classifying it under high-severity remote code execution prerequisites in many threat modeling frameworks.
Mitigation strategies must focus on immediate remediation of the vulnerable plugin version and reinforcement of general WordPress security hygiene. Administrators should update Security For WooCommerce to a patched version that correctly implements capability checks for all user creation endpoints. If updating is not immediately feasible, temporary mitigations include restricting access to the specific endpoint via web application firewall rules or disabling public registration entirely if it is not required by business logic. Additionally, implementing multi-factor authentication for all administrative accounts and regularly auditing user roles can help detect unauthorized privilege escalations early. Regular security audits and adherence to secure coding standards that mandate explicit authorization checks before performing state-changing operations are essential preventive measures against such vulnerabilities in the future.